What are the responsibilities and job description for the Cloud Engineer (Google Cloud) position at NexGen Tech Solutions?
What you’ll do
- Design and deliver GCP IAM as code — role bindings, custom roles and least-privilege role sets across organisation, folder and project scope — authored in Terraform, peer-reviewed and applied by pipeline.
- Manage the entitlements behind Workforce Identity Federation, so enterprise users reach GCP through the firm’s identity provider with their access declared in code rather than granted by hand.
- Wire up Workload Identity Federation for applications and pipelines — binding federated principals onto service accounts so a workload exchanges a token for GCP access instead of holding a key.
- Own the service-account lifecycle: naming, provisioning, ownership, impersonation, and the elimination of static keys.
- Design the role model— the reusable sets of entitlements that map a team or persona to the access it actually needs, so access is repeatable and reviewable instead of bespoke.
- Review access requests against a least-privilege standard: establish what a role genuinely grants, find the tightest role that meets the stated need, and record the decision.
What we’re looking for
Required
- Strong hands-on Terraform — authoring, reviewing and shipping IAM through modules and CI/CD.
- Strong hands-on GCP IAM — the policy model, inheritance across organisation, folder and project, and the practical difference between predefined and custom roles.
- Real depth on roles and permissions: able to work out what a role actually confers, spot an over-grant, and substitute a narrower role without breaking the use case.
- Ability to understand Workforce Identity Federation and Workload Identity Federation — how human access federates into GCP from an enterprise identity provider, and how a machine identity exchanges a federated token for GCP access instead of holding a key.
Nice to have
- IAM deny policies.
- IAM Conditions — conditional role bindings.
- Experience removing service-account keys at scale, or running a keyless migration.
- Custom role design and the governance around it.
- Experience operating in large regulated enterprise environments.